Executive brief
buffer-zor is a Node.js library package used by developers for data buffer manipulation. Version 2.0.2 was compromised with malicious code that silently stole Ethereum cryptocurrency by performing unauthorized transactions to wallets not controlled by the user. Any application using this compromised version could result in direct financial loss of cryptocurrency assets.
Technical details
This is a supply-chain attack involving intentional malicious code injection (CWE-506) into a public npm package. Version 2.0.2 of buffer-zor contained code that performed unauthorized Ethereum transactions, redirecting funds to attacker-controlled wallets. The attack requires only that a developer install and use the compromised package version; no additional authentication, network configuration, or user interaction is required beyond a normal package installation. An attacker gains the ability to exfiltrate cryptocurrency held in environments where the application has access to Ethereum wallets. The affected version should be immediately removed from all environments.
Affected products
- npm buffer-zor 2.0.2
Timeline
- 2020-09-03: disclosed